Seems like you'd need a mnemonic to remember the mnemonic.
–
belacquaFeb 7 '11 at 6:53

but how can one have a < in the password? in an international setting were you have different keyboards I would not recommend this.
–
MarcelFeb 9 '11 at 7:49

2

I haven't looked at this generator, but I hope it lets you generate passwords longer than 8 chars. 8, even with special chars, is well within the realms of instantaneous rainbow table pwnage, if the hash is ever grabbed (and this happens a lot!)
–
Rory AlsopJun 29 '11 at 8:59

pwgen generates random, meaningless but pronounceable passwords. These passwords contain either only lowercase letters, or upper and lower case mixed, or digits thrown in. Uppercase letters and digits are placed in a way that eases remembering their position when memorizing only the word. .

The results are more hideous even than apg or pwgen (even with the -s option set), but this is more fun:

head -c 8192 /dev/urandom | strings --bytes 8 | sed 's/\s//'

I suspect your use case if different, but this kind of thing is useful for shared secret keys, and other kinds of passwords that you don't type in very often.
To get a larger selection, pass more bytes to head, and to get longer password result strings, modify --bytes in strings (which gives a minimum length). the sed expression strips out strips out spaces and tabs (represented by \s).

However, you will at some point probably appreciate applications (like pwgen, KeePassX or LastPass) that give you an option to avoid easily confusable characters, like 1 and l and I . These can look like 1Il or 1Il or worse. You would want to use an option like this if you are resetting someone's password or giving a one-time passkey that needs to be communicated.

-B, --ambiguous
Don't use characters that could be confused by the user when
printed, such as 'l' and '1', or '0' or 'O'. This reduces the
number of possible passwords significantly, and as such reduces
the quality of the passwords. It may be useful for users who
have bad vision, but in general use of this option is not recom‐
mended.

This is nuts, of course. You probably know when this is useful or not. And it's certainly better than using 'Pa$$w0rD' for everything. If in doubt, create a longer password, or pass your generated password as input to another generator, or use multi-factor authentication.

SuperGenPass is a bookmarklet solution originally intended for website logins, but it can easily be used for applications, too. It uses a master password plus the current domain name (or application name, if you like) to generate 10-character passwords like lCY9gjiDtF. It doesn't need mnemonics because it can one-click auto-fill the password box, and allows copy/paste into other applications too.

I keep a bookmarklet in each of my browsers, and on my cell phone (works offline, too!). It's very convenient. If you're "brave" then you could even hardcode the master password into the bookmarklet.

Your old code was leaking the password to the webpage. This function makes it a bit more secure (providing that the webpage does not overwrite the used functions to capture the arguments ;))
–
LekensteynMay 27 '11 at 19:58